CVE-2026-103752: Authorizer Privilege Escalation Vulnerability

CVE-2026-103752 Overview

CVE-2026-103752 is an unauthenticated privilege escalation vulnerability affecting the WordPress Authorizer plugin in versions 3.15.3 and earlier. The flaw is classified under [CWE-266: Incorrect Privilege Assignment] and allows remote attackers to gain elevated privileges without authentication. Successful exploitation grants attackers administrative control over affected WordPress sites, enabling full compromise of site content, user data, and underlying server resources.

The vulnerability is network-exploitable, requires no user interaction, and has low attack complexity. Public disclosure was published through Patchstack Vulnerability Report.

Critical Impact
Unauthenticated remote attackers can escalate privileges to administrator on WordPress sites running Authorizer <= 3.15.3, resulting in full site takeover.

Affected Products

WordPress Authorizer plugin versions <= 3.15.3
WordPress sites using Authorizer for external authentication (CAS, LDAP, OAuth2, Google)
Multisite WordPress deployments relying on Authorizer for access control

Discovery Timeline

2026-10-01 - CVE-2026-103752 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103752

Vulnerability Analysis

The Authorizer plugin manages user authentication and authorization for WordPress, integrating with external identity providers and controlling access to site content. The vulnerability stems from incorrect privilege assignment logic within the plugin, allowing an attacker to acquire a role higher than intended without providing valid authentication credentials.

An unauthenticated request to the vulnerable code path results in the assignment of elevated capabilities to the requesting session or user account. Because WordPress treats administrator capabilities as near-root within the application layer, the attacker gains the ability to install plugins, modify themes, create users, and execute arbitrary PHP through standard administrative features.

Root Cause

The root cause is classified as [CWE-266: Incorrect Privilege Assignment]. The plugin fails to properly validate the authorization state before assigning user roles or capabilities during the authentication or user-provisioning flow. See the Patchstack Vulnerability Report for technical details.

Attack Vector

The attack is executed remotely over the network against the WordPress HTTP(S) endpoint. No credentials, prior access, or user interaction are required. An attacker reaches a plugin endpoint that triggers the flawed privilege assignment logic and obtains an administrator-level session or account. The attacker then uses standard WordPress administrative functionality to achieve remote code execution and persistence.

Detection Methods for CVE-2026-103752

Indicators of Compromise

Creation of new WordPress user accounts with the administrator role outside of normal provisioning windows.
Unexpected role changes on existing accounts recorded in the wp_usermeta table under the wp_capabilities key.
Installation or activation of unknown plugins or themes shortly after suspicious authentication activity targeting Authorizer endpoints.
HTTP requests to Authorizer plugin URLs from unauthenticated clients followed by authenticated administrative actions from the same source IP.

Detection Strategies

Audit the WordPress users list for administrator accounts that were not provisioned by legitimate administrators.
Review web server access logs for anomalous POST or GET requests targeting /wp-content/plugins/authorizer/ endpoints.
Correlate authentication events from the Authorizer plugin against the configured external identity provider logs for mismatches.

Monitoring Recommendations

Enable WordPress audit logging to capture user role changes, plugin installations, and option modifications in real time.
Forward WordPress and web server logs to a centralized SIEM for correlation and alerting on privilege-escalation patterns.
Alert on first-time administrator logins from new IP addresses or geographies, especially following requests to authentication plugin paths.

How to Mitigate CVE-2026-103752

Immediate Actions Required

Update the Authorizer plugin to a version newer than 3.15.3 as soon as a patched release is available from the vendor.
Audit all WordPress administrator accounts and remove any that cannot be attributed to a legitimate provisioning event.
Rotate credentials, secrets, and API keys stored in WordPress if an administrator account compromise is suspected.
Review installed plugins, themes, and mu-plugins for unauthorized code added after the disclosure date.

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status and the fixed version of the Authorizer plugin. Apply vendor updates through the WordPress plugin manager or by replacing the plugin directory with the patched release.

Workarounds

Deactivate and remove the Authorizer plugin until a patched version is installed, falling back to native WordPress authentication where feasible.
Restrict access to the WordPress site and /wp-login.php using a web application firewall (WAF) or IP allowlisting at the reverse proxy.
Add virtual patching rules at the WAF to block requests targeting known Authorizer plugin endpoints associated with the vulnerable code path.

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate authorizer
wp plugin delete authorizer